@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/agents-cc.mjs

@@ -0,0 +1,194 @@
+/**
+ * src/server/routes/agents-cc.mjs
+ *
+ * Sprint S10/S11 — Claude Code-native background agents.
+ *
+ * Reads the live agent roster via `claude agents --json`. Caches the
+ * result for 5s so the dashboard can poll every render without forking
+ * a subprocess per view. Provides unified `GET /api/cc-agents` that
+ * merges with session metadata so the dashboard shows a full picture
+ * (agent name, cwd, session id, status, started-at, etc).
+ *
+ * S11 — adds `POST /api/cc-agents/:id/kill` and
+ * `POST /api/cc-agents/:id/send` for the AgentDetail control plane.
+ */
+
+import { Router } from 'express';
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { wrap } from './_shared.mjs';
+
+const HOME = homedir();
+const CACHE_TTL_MS = 5_000;
+let _cache = null; // { ts, agents, error }
+
+function runClaudeAgents() {
+  return new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let done = false;
+    try {
+      const proc = spawn('claude', ['agents', '--json', '--all'], {
+        env: process.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+      const timer = setTimeout(() => {
+        if (!done) { done = true; try { proc.kill('SIGTERM'); } catch { /* */ } resolve({ ok: false, error: 'timeout', stderr: stderr.slice(0, 500) }); }
+      }, 4_000);
+      proc.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+      proc.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+      proc.on('error', (err) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        resolve({ ok: false, error: err.message, stderr });
+      });
+      proc.on('exit', (code) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        if (code !== 0) {
+          resolve({ ok: false, error: `exit ${code}`, stderr: stderr.slice(0, 500), stdout: stdout.slice(0, 500) });
+          return;
+        }
+        try {
+          const parsed = JSON.parse(stdout || '[]');
+          if (!Array.isArray(parsed)) {
+            resolve({ ok: false, error: 'unexpected shape', stdout: stdout.slice(0, 200) });
+            return;
+          }
+          resolve({ ok: true, agents: parsed });
+        } catch (err) {
+          resolve({ ok: false, error: `parse: ${err.message}`, stdout: stdout.slice(0, 200) });
+        }
+      });
+    } catch (err) {
+      resolve({ ok: false, error: err.message });
+    }
+  });
+}
+
+function enrichSession(agent) {
+  if (!agent || !agent.sessionId) return agent;
+  const file = join(HOME, '.claude', 'sessions', agent.sessionId, 'messages.jsonl');
+  if (!existsSync(file)) return agent;
+  try {
+    const st = statSync(file);
+    agent.lastMessageAt = st.mtimeMs;
+    const text = readFileSync(file, 'utf8');
+    agent.messageCount = text.split('\n').filter((l) => l.trim()).length;
+    // Read last assistant text snippet (best-effort).
+    const lines = text.split('\n').filter((l) => l.trim());
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+      try {
+        const obj = JSON.parse(lines[i]);
+        if (obj?.type === 'assistant' && obj?.message?.content) {
+          const c = obj.message.content;
+          const txt = typeof c === 'string' ? c
+            : Array.isArray(c) ? c.filter((b) => b && (b.type === 'text' || typeof b.text === 'string')).map((b) => b.text || '').join('\n')
+            : '';
+          if (txt) { agent.lastMessageSnippet = txt.replace(/\s+/g, ' ').trim().slice(0, 120); }
+          break;
+        }
+      } catch { /* skip */ }
+    }
+  } catch { /* best effort */ }
+  return agent;
+}
+
+async function listAgents({ force = false } = {}) {
+  const now = Date.now();
+  if (!force && _cache && (now - _cache.ts) < CACHE_TTL_MS) {
+    return _cache;
+  }
+  const r = await runClaudeAgents();
+  if (r.ok) {
+    const agents = r.agents.map(enrichSession);
+    _cache = { ts: now, agents, error: null };
+  } else {
+    _cache = { ts: now, agents: [], error: r.error || 'unknown' };
+  }
+  return _cache;
+}
+
+/**
+ * @param {{ broadcast?: Function }} deps
+ */
+export function createCCAgentsRouter({ broadcast = () => {} } = {}) {
+  const router = Router();
+
+  router.get('/cc-agents', wrap(async (_req, res) => {
+    const r = await listAgents();
+    res.json({ agents: r.agents, count: r.agents.length, error: r.error });
+  }));
+
+  router.get('/cc-agents/:id', wrap(async (req, res) => {
+    const r = await listAgents();
+    const agent = r.agents.find((a) => a.id === req.params.id || a.sessionId === req.params.id);
+    if (!agent) { res.status(404).json({ error: 'not_found' }); return; }
+    res.json(agent);
+  }));
+
+  // S11 — kill a CC background agent.
+  router.post('/cc-agents/:id/kill', wrap(async (req, res) => {
+    const id = req.params.id;
+    if (!id || !/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+      res.status(400).json({ error: 'bad_request', message: 'invalid id' });
+      return;
+    }
+    try {
+      const proc = spawn('claude', ['agents', 'kill', id], {
+        env: process.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+      let stderr = '';
+      proc.stderr.on('data', (c) => { stderr += c.toString('utf8'); });
+      const exitCode = await new Promise((resolve) => proc.on('exit', resolve));
+      _cache = null; // bust cache so the next list reflects the kill
+      broadcast({ type: 'agents:change' });
+      if (exitCode === 0) {
+        res.json({ ok: true, id });
+      } else {
+        res.status(502).json({ ok: false, error: `exit ${exitCode}`, stderr: stderr.slice(0, 500) });
+      }
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err.message });
+    }
+  }));
+
+  // S11 — send a follow-up prompt to a CC background agent.
+  router.post('/cc-agents/:id/send', wrap(async (req, res) => {
+    const id = req.params.id;
+    const prompt = String((req.body && req.body.prompt) || '').trim();
+    if (!prompt) {
+      res.status(400).json({ error: 'bad_request', message: 'prompt is required' });
+      return;
+    }
+    if (!id || !/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+      res.status(400).json({ error: 'bad_request', message: 'invalid id' });
+      return;
+    }
+    const { spawnAgent } = await import('../claude-runner.mjs');
+    const result = await spawnAgent({
+      prompt,
+      agent: undefined,
+      worktree: HOME,
+      logPath: join(HOME, '.claude', 'sessions', '_new', `${Date.now()}.log`),
+      background: true,
+      sessionIdTimeoutMs: 5_000,
+    });
+    if (!result.ok) {
+      res.status(502).json({ ok: false, error: result.error || 'spawn failed' });
+      return;
+    }
+    _cache = null;
+    broadcast({ type: 'agents:change' });
+    res.json({ ok: true, sessionId: result.sessionId, processId: result.processId });
+  }));
+
+  return router;
+}
+
+export const _internals = { listAgents, runClaudeAgents, enrichSession, CACHE_TTL_MS };

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/agents.mjs

@@ -0,0 +1,134 @@
+/**
+ * src/server/routes/agents.mjs
+ *
+ * /api/agents                            — list
+ * /api/agents/stuck                      — agents exceeding the stuck threshold
+ * /api/agents/hierarchy                  — parent/child tree
+ * /api/agents/:name                      — single agent metadata
+ * /api/agents (POST)                     — create
+ * /api/agents/:name (PUT)                — update
+ * /api/agents/:name/invoke (POST)        — log an invocation intent
+ * /api/agents/:name/status (POST)        — update status (idle|working|error|stuck)
+ * /api/agents/:name/heartbeat (POST)     — bump last-heartbeat
+ * /api/agents/:name/restart (POST)       — restart
+ * /api/agents/:name (DELETE)             — remove
+ *
+ * Express-ordering notes:
+ *   - /agents/stuck MUST come before /agents/:name (else "stuck"
+ *     gets captured as a name).
+ *   - /agents/hierarchy MUST come before /agents/:name (same reason).
+ */
+import { Router } from 'express';
+import { agentsStore, buildHierarchyTree } from '../agents-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createAgentsRouter({ state, broadcast }) {
+  const router = Router();
+
+  router.get('/agents', wrap(async (_req, res) => {
+    res.json({ agents: agentsStore.list() });
+  }));
+
+  // v3.1.0 — /api/agents/stuck must be defined BEFORE the /:name
+  // catch-all or Express will treat "stuck" as an agent name.
+  router.get('/agents/stuck', wrap(async (_req, res) => {
+    res.json({ stuck: agentsStore.stuck() });
+  }));
+
+  // v3.2.0 — Agent hierarchy. Must be defined BEFORE /agents/:name
+  // or Express will treat "hierarchy" as a name.
+  router.get('/agents/hierarchy', wrap(async (_req, res) => {
+    const agents = agentsStore.list();
+    const tree = buildHierarchyTree(agents);
+    res.json(tree);
+  }));
+
+  router.get('/agents/:name', wrap(async (req, res) => {
+    const agent = agentsStore.get(req.params.name);
+    if (!agent) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json(agent);
+  }));
+
+  router.post('/agents', wrap(async (req, res) => {
+    const agent = agentsStore.create(req.body || {});
+    broadcast({ type: 'agents:change' });
+    res.status(201).json(agent);
+  }));
+
+  router.put('/agents/:name', wrap(async (req, res) => {
+    const agent = agentsStore.update(req.params.name, req.body || {});
+    broadcast({ type: 'agents:change' });
+    res.json(agent);
+  }));
+
+  router.post('/agents/:name/invoke', wrap(async (req, res) => {
+    const name = req.params.name;
+    const prompt = (req.body && req.body.prompt) || '';
+    if (!prompt.trim()) {
+      res.status(400).json({ error: 'bad_request', message: 'prompt is required' });
+      return;
+    }
+    state.appendActivity({ kind: 'agent.invoke', agent: name, prompt: String(prompt).slice(0, 500) });
+    res.status(202).json({ accepted: true, agent: name });
+  }));
+
+  // v3.1.0 — Agent status (idle / working / error / stuck). The cline
+  // plugin pings this when it picks up or finishes a task; the dashboard
+  // also calls it on the lifecycle hooks below.
+  router.post('/agents/:name/status', wrap(async (req, res) => {
+    const name = req.params.name;
+    const { status, currentTaskId } = req.body || {};
+    const valid = ['idle', 'working', 'error', 'stuck'];
+    if (status && !valid.includes(status)) {
+      res.status(400).json({ error: 'bad_request', message: `invalid status (use: ${valid.join(', ')})` });
+      return;
+    }
+    const agent = agentsStore.updateStatus(name, status || 'idle', currentTaskId ?? null);
+    if (!agent) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'agent:status', agent });
+    res.json(agent);
+  }));
+
+  router.post('/agents/:name/heartbeat', wrap(async (req, res) => {
+    const agent = agentsStore.heartbeat(req.params.name);
+    if (!agent) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json(agent);
+  }));
+
+  router.post('/agents/:name/restart', wrap(async (req, res) => {
+    const agent = agentsStore.restart(req.params.name);
+    if (!agent) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'agent:restarted', agent });
+    res.json(agent);
+  }));
+
+  router.delete('/agents/:name', wrap(async (req, res) => {
+    const ok = agentsStore.delete(req.params.name);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'agents:change' });
+    res.status(204).end();
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/artifacts.mjs

@@ -0,0 +1,279 @@
+/**
+ * src/server/routes/artifacts.mjs
+ *
+ * /api/artifacts                              — list
+ * /api/artifacts/:slug                        — read
+ * /api/artifacts (POST)                       — create
+ * /api/artifacts/:slug (PUT)                  — update meta
+ * /api/artifacts/:slug (DELETE)               — remove
+ * /api/artifacts/:slug/canvas (GET)           — read canvas
+ * /api/artifacts/:slug/canvas (PUT)           — save canvas
+ * /api/artifacts/:slug/elements (POST)        — add element
+ * /api/artifacts/:slug/elements/:id (PUT)     — update element
+ * /api/artifacts/:slug/elements/:id (DELETE)  — remove element
+ * /api/artifacts/:slug/position (PUT)         — bulk position update
+ * /api/artifacts/:slug/connections (POST)     — add connection
+ * /api/artifacts/:slug/connections/:id (DELETE) — remove connection
+ * /api/artifacts/:slug/elements/:id/comments (POST) — comment on element
+ * /api/artifacts/:slug/elements/:id/comments/:cid (DELETE) — remove element comment
+ * /api/artifacts/:slug/comments (POST)        — canvas-level comment
+ * /api/artifacts/:slug/comments/:cid (DELETE) — remove canvas-level comment
+ * /api/artifacts/:slug/questions/:qid/respond (POST) — agent answers a question element
+ * /api/artifacts/:slug/submit (POST)                — submit feedback for review (writes feedback.md, sets status=review)
+ * /api/artifacts/:slug/render (GET)              — compile MDX → JSON glyph blocks
+ */
+import { Router } from 'express';
+import { artifactsStore } from '../artifacts-store.mjs';
+import { notificationsStore } from '../notifications-store.mjs';
+import { wrap } from './_shared.mjs';
+import { compileGlyphMdx } from '../glyphs/mdx-compiler.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createArtifactsRouter({ state, broadcast, projectRoot }) {
+  const router = Router();
+
+  router.get('/artifacts', wrap(async (_req, res) => {
+    res.json({ artifacts: artifactsStore.list(projectRoot) });
+  }));
+
+  router.get('/artifacts/:slug', wrap(async (req, res) => {
+    const artifact = artifactsStore.get(req.params.slug, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json(artifact);
+  }));
+
+  // v3.21.0 — Compile the artifact's MDX into a JSON-serializable
+  // glyph structure for the new Glyphs renderer. Returns frontmatter
+  // + a flat list of typed blocks, ready for the client-side block
+  // component map to render.
+  router.get('/artifacts/:slug/render', wrap(async (req, res) => {
+    const artifact = artifactsStore.get(req.params.slug, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const compiled = await compileGlyphMdx(artifact.planMdx || '');
+    res.json({ slug: req.params.slug, ...compiled });
+  }));
+
+  // v3.1.0 — Full artifact CRUD + canvas editing.
+  router.post('/artifacts', wrap(async (req, res) => {
+    const slug = (req.body?.slug || '').trim();
+    try {
+      const artifact = artifactsStore.create(slug, req.body || {}, projectRoot);
+      broadcast({ type: 'artifact:change', slug });
+      res.status(201).json(artifact);
+    } catch (err) {
+      res.status(err.status || 500).json({ error: 'create_failed', message: err.message });
+    }
+  }));
+
+  router.put('/artifacts/:slug', wrap(async (req, res) => {
+    const artifact = artifactsStore.updateMeta(req.params.slug, req.body || {}, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(artifact);
+  }));
+
+  router.delete('/artifacts/:slug', wrap(async (req, res) => {
+    const ok = artifactsStore.delete(req.params.slug, projectRoot);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug, deleted: true });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/canvas ──────────────────────────────────────────
+  router.get('/artifacts/:slug/canvas', wrap(async (req, res) => {
+    const canvas = artifactsStore.getCanvas(req.params.slug, projectRoot);
+    if (!canvas) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json({ canvas });
+  }));
+
+  router.put('/artifacts/:slug/canvas', wrap(async (req, res) => {
+    const artifact = artifactsStore.saveCanvas(req.params.slug, req.body?.canvas, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(artifact);
+  }));
+
+  // ── /api/artifacts/:slug/elements ────────────────────────────────────────
+  router.post('/artifacts/:slug/elements', wrap(async (req, res) => {
+    const out = artifactsStore.addElement(req.params.slug, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.put('/artifacts/:slug/elements/:id', wrap(async (req, res) => {
+    const out = artifactsStore.updateElement(req.params.slug, req.params.id, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  router.delete('/artifacts/:slug/elements/:id', wrap(async (req, res) => {
+    const out = artifactsStore.deleteElement(req.params.slug, req.params.id, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/position — bulk update positions (drag end) ─────
+  router.put('/artifacts/:slug/position', wrap(async (req, res) => {
+    const out = artifactsStore.updatePositions(req.params.slug, req.body?.positions, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  // ── /api/artifacts/:slug/connections ─────────────────────────────────────
+  router.post('/artifacts/:slug/connections', wrap(async (req, res) => {
+    const out = artifactsStore.addConnection(req.params.slug, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'from and to are required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/connections/:id', wrap(async (req, res) => {
+    const out = artifactsStore.deleteConnection(req.params.slug, req.params.id, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/elements/:id/comments ───────────────────────────
+  router.post('/artifacts/:slug/elements/:id/comments', wrap(async (req, res) => {
+    const out = artifactsStore.addComment(req.params.slug, req.params.id, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'comment text is required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/elements/:id/comments/:cid', wrap(async (req, res) => {
+    const out = artifactsStore.deleteComment(req.params.slug, req.params.cid, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // Canvas-level comments (no elementId) — POST /artifacts/:slug/comments
+  router.post('/artifacts/:slug/comments', wrap(async (req, res) => {
+    const out = artifactsStore.addComment(req.params.slug, null, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'comment text is required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/comments/:cid', wrap(async (req, res) => {
+    const out = artifactsStore.deleteComment(req.params.slug, req.params.cid, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/submit (v3.22.0) ─────────────────────────────
+  // "Submit to agent" — collect free-placed comments + OpenQuestion
+  // answers, write a structured `feedback.md` the agent can read,
+  // mark the artifact `status: review`, and return the summary.
+  router.post('/artifacts/:slug/submit', wrap(async (req, res) => {
+    const result = artifactsStore.submitFeedback(
+      req.params.slug,
+      req.body || {},
+      projectRoot,
+    );
+    if (!result.ok) {
+      res.status(result.error === 'invalid_slug' ? 400 : 404).json({
+        error: result.error || 'not_found',
+      });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(result);
+  }));
+
+  // ── /api/artifacts/:slug/questions/:qid/respond (v3.3.0) ──────────────
+  // Agent-side integration for the question element: an agent posts
+  // a question via the artifact's canvas; the user clicks a choice in
+  // the dashboard, this endpoint records the choice, marks the
+  // question resolved, and broadcasts the answer so the agent
+  // (when its plugin is updated) can pick it up.
+  router.post('/artifacts/:slug/questions/:qid/respond', wrap(async (req, res) => {
+    const { choiceId, text } = req.body || {};
+    const out = artifactsStore.respondToQuestion(
+      req.params.slug,
+      req.params.qid,
+      { choiceId, text },
+      projectRoot,
+    );
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    // Also drop a notification so the agent can re-poll.
+    try {
+      notificationsStore.add({
+        severity: 'info',
+        source: 'artifact',
+        title: `Artifact: ${req.params.slug}`,
+        message: `Question answered: choice=${choiceId || 'freeform'}`,
+        link: `/artifacts/${req.params.slug}`,
+        meta: { slug: req.params.slug, qid: req.params.qid, choiceId, text },
+      }, { broadcast });
+    } catch { /* best-effort */ }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/auth.mjs

@@ -0,0 +1,69 @@
+/**
+ * src/server/routes/auth.mjs
+ *
+ * v3.6.0 — Auth-related routes: status, reveal, regenerate.
+ *
+ * /api/auth/status   — UNAUTHED. Returns { required: true } so a
+ *                      client can detect that auth is on and ask the
+ *                      operator to paste a token.
+ * /api/auth/reveal   — AUTHED. Returns the current token. Only useful
+ *                      to someone who already has it (chicken-and-egg
+ *                      by design — initial token comes from server
+ *                      stderr on first boot).
+ * /api/auth/regenerate — AUTHED. Mints a new token, invalidating the
+ *                      old one immediately. The response body carries
+ *                      the new token ONCE — the caller must persist
+ *                      it client-side.
+ */
+import { Router } from 'express';
+import {
+  getDirectPeerAddress,
+  getOrCreateSecret,
+  isAuthRequired,
+  isLoopback,
+  regenerateSecret,
+} from '../auth.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createAuthRouter() {
+  const router = Router();
+
+  // Unauthed status probe. Tells the client whether auth is required
+  // and whether the current connection is loopback (in which case
+  // the server is auto-trusting it and the client doesn't need to
+  // send a token). This is how the dashboard "just works" in a
+  // browser on the same machine as the server. Reverse-proxy access
+  // still reports the direct peer so operators can tell whether a
+  // bearer token will be required.
+  router.get('/auth/status', (req, res) => {
+    const trusted = isLoopback(req);
+    res.json({
+      required: isAuthRequired(req),
+      loopback: trusted,
+      // Surface the direct peer for the Settings UI to display
+      // (helps the operator debug if the auto-trust isn't kicking
+      // in as expected — e.g. they're hitting a different bind).
+      peer: getDirectPeerAddress(req),
+    });
+  });
+
+  // AUTHED — returns the current token. The caller is presumed to
+  // already have it (that's why the auth middleware let them in);
+  // we just hand it back so the UI can render a "Copy token" button.
+  router.get('/auth/reveal', wrap((_req, res) => {
+    res.json({ token: getOrCreateSecret() });
+  }));
+
+  // AUTHED — rotate the token. Anything still holding the old token
+  // will start getting 401s immediately. The new token is in the
+  // response body; the caller MUST save it.
+  router.post('/auth/regenerate', wrap((_req, res) => {
+    const newToken = regenerateSecret();
+    res.json({ token: newToken });
+  }));
+
+  return router;
+}